Add active status field to access entries

Track whether an account is active (enabled) or disabled at the
source system. The field is nullable so existing entries without
this data remain valid.

- DB migration adds active BOOLEAN column to access_entries
- Coredata read/write/upsert/filter wiring for the new column
- Review engine propagates Active from source accounts
- GraphQL schema exposes active on AccessEntry and AccessEntryFilter
- MCP spec, types, and resolvers expose active and fix missing
  account_type filter that was wired in GraphQL but not MCP
- CLI list command adds --active filter flag and ACTIVE output column
- Console campaign detail table shows Active/Disabled status badge
- E2e and unit tests updated to cover the new field

Signed-off-by: Bryan Frimin <bryan@probo.com>

pkg/server/api/console/v1/graphql/access_review_campaign.graphql

@@ -280,6 +280,7 @@ input AccessEntryFilter
     flag: AccessEntryFlag
     incrementalTag: AccessEntryIncrementalTag
     isAdmin: Boolean
+    active: Boolean
     authMethod: AccessEntryAuthMethod
     accountType: AccessEntryAccountType
 }
@@ -372,6 +373,7 @@ type AccessEntry implements Node {
     role: String!
     jobTitle: String!
     isAdmin: Boolean!
+    active: Boolean
     mfaStatus: MfaStatus!
     authMethod: AccessEntryAuthMethod!
     accountType: AccessEntryAccountType!

pkg/server/api/console/v1/types/access_review.go

@@ -249,6 +249,7 @@ func NewAccessEntry(e *coredata.AccessEntry) *AccessEntry {
 		Role:             e.Role,
 		JobTitle:         e.JobTitle,
 		IsAdmin:          e.IsAdmin,
+		Active:           e.Active,
 		MfaStatus:        e.MFAStatus,
 		AuthMethod:       e.AuthMethod,
 		AccountType:      e.AccountType,